You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When running this command: ./target/release/hayabusa csv-timeline -d ../hayabusa-sample-evtx -r ../hayabusa-rules/hayabusa/builtin/PowerShellClassic/PwShClassic_400_Info_PwShEngineStarted.yml
with this new rule:
author: Zach Mathis
date: 2023/10/18
modified: 2023/10/18
title: 'PwSh Engine Started'
description: 'Engine state is changed from None to Available.'
id: 8c58ee7c-d741-40ae-9af4-104d62e3b727
level: informational
status: test
logsource:
product: windows
service: powershell
detection:
selection:
Channel: 'Windows PowerShell'
EventID: 400
condition: selection
falsepositives:
tags:
references:
ruletype: Hayabusa
when I output to CSV: -o test-400.csv and check the results there are spaces just like the original log:
Example
When running this command:
./target/release/hayabusa csv-timeline -d ../hayabusa-sample-evtx -r ../hayabusa-rules/hayabusa/builtin/PowerShellClassic/PwShClassic_400_Info_PwShEngineStarted.yml
with this new rule:
when I output to CSV:
-o test-400.csv
and check the results there are spaces just like the original log:Example
However, the standard output shows this:
I want to keep spaces between
CommandName=
,CommandType=
, etc...@hitenkoku Could you check this?
The text was updated successfully, but these errors were encountered: